f101a45d8085c6fc1fa111aa9219abe2adcc16705f3ebeb91626fbd085ba9d13

Sharing

Copy URL Twitter E-mail

General

Target
ryujinx.zip
Size 77.7MB
Sample260710-c8y3eact2m
SHA256 f101a45d8085c6fc1fa111aa9219abe2adcc16705f3ebeb91626fbd085ba9d13
MD5 11724fce9f766a838d7dc18e4b2132d6
SHA1 4b54fdc4845245edb8b64a8adf5156a43f3a1827
SHA512 12d69d85b894a130b56074bc0d3d77d50d0cab509c90a4ec7755a8320db93ba44b97a7c52a9601765483dc8b3d8d2b236bca011d6f5bf95c2cb5c6dcc1216dae
SSDEEP 1572864:L92refS7gojGaqKR3Nporg118m0Fml3ldyUyIWgQcmx9HjfjO2EjP7ueL9YJYu+v:LsISuaxR3Nporgff1pdWgQrxViPr9K+v
TLSH
T17C0833406C98FE7D3D0668B624EDA11F25263A0443B10777FBF9227E628B751DEA4B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ryujinx/Ryujinx_Setup.exe
- Size 505KB
- SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
- MD5 bf3f290275c21bdd3951955c9c3cf32c
- SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
- SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
- SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
- TLSH
  T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  ryujinx/dsetup.dll
- Size 80.0MB
- SHA256 c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6
- MD5 1ef0113bc0e9e2d0efe9021c0b3421e8
- SHA1 bbf57300b43c53857d6fb25f46b9f15b76fbf382
- SHA512 01a72d38e4ca9afbc8df6de32be6f8686e4ae4283d071c419e26d94c31145d009ccc1ab6e73c5939af5aa451e6b1d547086750426701d6c572c2be8d7ab695c0
- SSDEEP 1572864:s/2rwnAPGuRuAKEFx3hWt+dVGsmFi9lL8YycbwcnzCm2fSngYfian7MiefV3Qd6O:saKA+AnFx3hWt+ndZ8Yycbjnun2vxPt
- TLSH
  T12A083312B2C8E53EE0B71A35687FE211593B7A147A22CD0F27A0095C5FF7A406E29F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  ryujinx/dsetup_orig.dll
- Size 93KB
- SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
- MD5 eb701def7d0809e8da765a752ab42be5
- SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
- SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
- SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
- TLSH
  T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral11 behavioral12 behavioral9